0token (>=0.1.0, <=0.4.0), 3-04-2025-ttm (0.1.0) +12410 more potentially affected by CVE-2025-14928 via transformers (>=0.1.0, <=5.16.1)

transformers PYPI version =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.1.0.dev1, =0.1.5, =0.1.0, =0.10.11, =0.5.5, =0.0.4.80, =5.0.6 and more Source cves: CVE-2025-14928 Source advisory: SNYK:PYTHON-TRANSFORMERS-14564364...

0token (>=0.1.0, <=0.4.0), 3-04-2025-ttm (0.1.0) +12410 more potentially affected by CVE-2025-14921 via transformers (>=0.1.0, <=5.16.1)

transformers PYPI version =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.1.0.dev1, =0.1.5, =0.1.0, =0.10.11, =0.5.5, =0.0.4.80, =5.0.6 and more Source cves: CVE-2025-14921 Source advisory: SNYK:PYTHON-TRANSFORMERS-14564365...

0token (>=0.1.0, <=0.4.0), 3-04-2025-ttm (0.1.0) +12410 more potentially affected by CVE-2025-14924 via transformers (>=0.1.0, <=5.16.1)

transformers PYPI version =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.1.0.dev1, =0.1.5, =0.1.0, =0.10.11, =0.5.5, =0.0.4.80, =5.0.6 and more Source cves: CVE-2025-14924 Source advisory: SNYK:PYTHON-TRANSFORMERS-14564363...

0token (>=0.1.0, <=0.4.0), 3-04-2025-ttm (0.1.0) +12410 more potentially affected by CVE-2025-14929 via transformers (>=0.1.0, <=5.16.1)

transformers PYPI version =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.1.0.dev1, =0.1.5, =0.1.0, =0.10.11, =0.5.5, =0.0.4.80, =5.0.6 and more Source cves: CVE-2025-14929 Source advisory: SNYK:PYTHON-TRANSFORMERS-14564275...

0token (>=0.1.0, <=0.4.0), 3-04-2025-ttm (0.1.0) +12410 more potentially affected by CVE-2025-14930 via transformers (>=0.1.0, <=5.16.1)

transformers PYPI version =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.1.0.dev1, =0.1.5, =0.1.0, =0.10.11, =0.5.5, =0.0.4.80, =5.0.6 and more Source cves: CVE-2025-14930 Source advisory: SNYK:PYTHON-TRANSFORMERS-14563374...

0token (>=0.1.0, <=0.4.0), 3-04-2025-ttm (0.1.0) +12410 more potentially affected by CVE-2025-14926 via transformers (>=0.1.0, <=5.16.1)

transformers PYPI version =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.1.0.dev1, =0.1.5, =0.1.0, =0.10.11, =0.5.5, =0.0.4.80, =5.0.6 and more Source cves: CVE-2025-14926 Source advisory: SNYK:PYTHON-TRANSFORMERS-14560695...

Malicious code in blastchamber-python-pypi (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-192658 Malicious code in connections-api-hidden-runner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ae6bedba7c21e763c5a0e27952cf75a13a7705e7681027c87a833417a2035b70 Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in f5rest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f8084e3c4c369a7dc22b67657aa22f3faf8e9b98df2721c9ff4e4c17d36fe028 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

hubzoid (>=0.2.2, <=0.9.3), openwebui-token-tracking (>=0.1.7, <=0.1.10) +1 more potentially affected by CVE-2025-63391 via open-webui (>=0.6.0, <=0.11.3)

open-webui PYPI version =0.6.0, =0.2.2, =0.1.7, =0.1.0, =0.1.5 Source cves: CVE-2025-63391 Source advisory: SNYK:PYTHON-OPENWEBUI-14535452...

Security Bulletin: NVIDIA NeMo Framework - December 2025

NVIDIA has released a software update for NVIDIA® NeMo Framework. To protect your system, clone or update this software to version 2.5.3 or later from NVIDIA/NeMo Framework on NVIDIA GitHub and pypi. Go to NVIDIA Product Security...

Malicious code in helloharry123p (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6e199ebf30ba4e39d4e6bd9fc4d31ffa9f0a7687e21f67e2e6e8c01e3f24717a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-192351 Malicious code in evil-rce (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 74a74a4133ed8082eba8452bb59a82dcf6975e1e8c4d6630a47088c17d6b6cca Running the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-evil-rce...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +1 more potentially affected by CVE-2025-34291 via langflow-base (>=0.7.2, <=0.11.6)

langflow-base PYPI version =0.7.2, =1.10.0, =1.8.0rc0, =1.8.0rc2 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2025-34291 Source advisory: SNYK:PYTHON-LANGFLOWBASE-14221425...

agent-os-server (>=0.4.2, <=0.5.10), aiodatalayer (>=1.0.0, <=2.3.1) +76 more potentially affected by CVE-2025-65896 via asyncmy (>=0.2.5, <=0.2.14)

asyncmy PYPI version =0.2.5, =0.4.2, =1.0.0, =0.5.0, =1.5.0, =1.0.8, =2.0.9, =1.0.8, =1.0.0, =1.0.0, =1.3.9, =0.1.1, =0.1.0, =0.2.0, =1.0.0, =1.3.12 and more Source cves: CVE-2025-65896 Source advisory: SNYK:PYTHON-ASYNCMY-14185104...

MAL-2025-191761 Malicious code in hooktest3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3d1104ab742749c40acd3c4c989dba15890db64fd22f688dea72727fbc5b9d23 During installation, the package starts a code to retrieve and execute commands from Discord --- Category: MALICIOUS - The campaign has clearly malicious inten...

Malicious code in discordhelper-ecr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 689b1c190dc23f0188a57cac218b8dd66c56ecb77478d9bdac584a8cd111bb9b Package exftrates discord credentials to a hardcoded location --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

tutor-android (>=17.0.0, <=22.0.0), tutor-cairn (>=17.0.0, <=22.0.0) +52 more potentially affected by CVE-2025-65681 via tutor (>=12.2.0, <=22.0.2)

tutor PYPI version =12.2.0, =17.0.0, =17.0.0, =0.1.1, =0.2.0, =14.0.0, =18.3.0, =18.0.0, =14.0.0rc3, =1.0.0, =18.2.8, =14.0.0, =19.0.0, =21.1.1 and more Source cves: CVE-2025-65681 Source advisory: SNYK:PYTHON-TUTOR-14135978...

Remote Command Execution

scio-pypi is vulnerable to Remote Command Execution. The vulnerability is due to torch.load executing unsafe deserialization even when weightsonly=True, which allows an attacker to craft malicious model files that trigger arbitrary code execution during loading...

Malicious code in atlassian-praz (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 06798e3c48471c4e66160030618f78c51d71d2a7660c5545648cf7902b3eecd4 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...